C:\javik-remifa_say.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fad02e51291b3038659473cff47e29d0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fad02e51291b3038659473cff47e29d0_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fad02e51291b3038659473cff47e29d0_JaffaCakes118
-
Size
13.3MB
-
MD5
fad02e51291b3038659473cff47e29d0
-
SHA1
5ab067004bc8296c68fd9371eb5be7a35925b51a
-
SHA256
93a0cf66597311ab47acf053542131ad5ed2410d1e25c67b1e77e7b324bd9e88
-
SHA512
dc8203a4281d15e5ffb791a9260917cd92e67db1658948f4da74e61ec0365a40263fe5a98d809ddf97173d243f7289b442041f4ae094a33009b05400169a69aa
-
SSDEEP
49152:EHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH:
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource fad02e51291b3038659473cff47e29d0_JaffaCakes118
Files
-
fad02e51291b3038659473cff47e29d0_JaffaCakes118.exe windows:5 windows x86 arch:x86
65cee1cc96d935afa5d7eb55e18fefb3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GlobalDeleteAtom
FindFirstFileW
TlsGetValue
GetStringTypeA
SetLocalTime
GetDriveTypeW
GetNumberOfConsoleInputEvents
MapUserPhysicalPages
CallNamedPipeA
InterlockedIncrement
GetCommState
InterlockedDecrement
ScrollConsoleScreenBufferW
WritePrivateProfileSectionA
WaitForSingleObject
WriteConsoleInputA
SignalObjectAndWait
OpenSemaphoreA
CreateDirectoryExA
FreeEnvironmentStringsA
GetModuleHandleW
GetPrivateProfileStringW
GetConsoleTitleA
WriteFileGather
FindResourceExA
GetPrivateProfileStructW
SetVolumeMountPointA
GetSystemTimeAdjustment
GlobalFlags
GetComputerNameExA
Beep
SetMessageWaitingIndicator
VerifyVersionInfoA
GetBinaryTypeA
GetAtomNameW
ReadFile
CreateFileW
CompareStringW
GetACP
lstrlenW
LCMapStringA
VerifyVersionInfoW
CreateDirectoryA
HeapReAlloc
SetCurrentDirectoryA
OpenMutexW
IsDBCSLeadByteEx
GetProcAddress
SetVolumeLabelW
SetStdHandle
SetComputerNameA
CreateMemoryResourceNotification
SetFileApisToOEM
Process32FirstW
OpenWaitableTimerW
LocalAlloc
GetFileType
SetConsoleOutputCP
QueryDosDeviceW
WriteProfileSectionW
GetCommMask
AddAtomA
SetCommMask
EnumResourceTypesW
SetConsoleCursorInfo
GetThreadPriority
SetConsoleTitleW
GetModuleHandleA
EnumResourceNamesA
FindNextFileW
RequestWakeupLatency
BuildCommDCBA
GetCurrentDirectoryA
SetCalendarInfoA
GetVersionExA
GetWindowsDirectoryW
GetCurrentProcessId
FindActCtxSectionStringW
ReadConsoleOutputCharacterW
InterlockedPushEntrySList
GetProfileSectionW
GetVolumeInformationW
CloseHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
RaiseException
InterlockedExchange
FileTimeToDosDateTime
GetLastError
MoveFileA
GetCommandLineW
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
DecodePointer
ExitProcess
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapValidate
IsBadReadPtr
EncodePointer
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
WriteFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetOEMCP
GetCPInfo
IsValidCodePage
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
HeapAlloc
GetModuleFileNameA
HeapSize
HeapQueryInformation
HeapFree
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
IsProcessorFeaturePresent
FlushFileBuffers
user32
GetCursorInfo
GetMenuInfo
GetMessageTime
GetMenuBarInfo
advapi32
InitiateSystemShutdownW
Sections
.text Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13.0MB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ